2019-2020-1 20199321 "Linux kernel principle and Analysis" in the eighth week of work

Executable program works

study notes

• ELF (Excutable and Linking the Format) and can be linked to the implementation of the format, a standard object file format.
  • Relocatable files: a source code file to generate a relocatable files (.o files), all the files will be linked to a .o file ---- Linux kernel.
  • Executable: holds a program for execution by a plurality of generally binding relocatable file generation is completed all of the work relocation and symbol resolution files (except parsed run-time shared library symbols).
  • Shared object file: No main function of "executable" file, only a pile of function calls available to other executable files. (.So file).
• ELF format
  • ELF file index table
    • ELF is the main file of the various sections:
      
  • Header Structure
    • e_ident fifth byte array, represents a 32-bit, 64-bit 2 indicates.
    • e_type reflects the ELF file type, e_type value 1,2,3,4 represent relocatable files, executable files, shared object files and core files.
  • Section Header structure
    • Description file
    • Target file must contain a section for linking the head table area
  • Program Header Structure
    • Section header table and create a process-related
    • The process used to construct the image file must have a section header table

• Compiled

  • Pretreatment: GCC -E Hello .c -o Hello .i
  • 编译：gcc -S hello.i -o hello.s
  • 汇编：gcc -c hello.s -o hello.o
  • 链接：gcc hello.o -o hello
    
• Static Link : copy directly linked at compile the code required to execute the final executable file, the advantage of fast loading speed code, execution speed is faster, low dependence on the external environment. The disadvantage is that if multiple applications use the same library function, can be loaded multiple times, wasting memory.
  Dynamic Link : do not directly copy the executable code at compile time, but by recording a series of symbols and parameters, when the program is run or pass this information to load the operating system. The operating system is responsible for the dynamic libraries required to load into memory when the program is run to the specified code to perform dynamic shared libraries already loaded in memory to execute code, and ultimately achieve the purpose of the link is running. Advantage is that multiple programs can share the same piece of code, without the need to store a plurality of replicated on the disk. The disadvantage is loaded at run time may affect the performance of the early implementation of the program, but also for the use of library dependencies higher. Into a dynamic link loading and dynamically linked runtime .
• exec function: the executable file to execute a function, essentially implement the system performs an executable file called sys_execve ().
  • 调用关系：sys_execve() -> do_execve() -> do_execve_common() -> exec_binprm() -> search_binary_handler() -> load_elf_binary() -> start_thread()
    
  • fork and execve distinction and connection
    • They are special system calls
    • After the fork into the kernel mode have returned twice, the first time to return to the original position of the parent process continues down, the second was in the child returns, the returns to ret_from_fork, then return to the normal user mode.
    • execve caught in the implementation of kernel mode, calling the executable file in the kernel execve loaded the executable program to cover the current process, when it returns, the return is not the original one executable program, but rather a new procedure returns to the starting point of the new executable program, i.e., the approximate location of the main function (typically address 0x8048xxx, set by the compiler).
    • Kernel supports multi-format at execute execve, it loads the top of the file, the file is to determine what format, looking for ways to parse this file format of kernel modules in the list.

Experimental part